Executive brief
The Linux kernel's Bluetooth ISO socket implementation fails to properly initialize socket address structures before returning them to user applications. An unprivileged attacker can retrieve sensitive kernel memory contents by calling standard socket functions like getsockname() and getpeername(), potentially exposing confidential data from the kernel stack to user space.
Technical details
The vulnerability is an information disclosure (kernel stack leak) in the iso_sock_getname() function within net/bluetooth/iso.c. The function constructs a sockaddr_iso structure and returns it without memset()-ing the buffer first, causing uninitialized stack bytes to be copied to user space. Two specific ranges leak: a 1-byte pad in the base sockaddr_iso structure and 7 uninitialized bytes (bc_bdaddr and bc_bdaddr_type) in the broadcast peer extension for BIS_LINK and PA_LINK connections. The vulnerability is reachable by any unprivileged process that opens a BTPROTO_ISO socket; the basic leak requires only getsockname(), while the broadcast leak requires an established connection. The fix adds memset() calls to zero-initialize the structures before population, consistent with existing practice in l2cap and rfcomm.
Affected products
- Linux Linux kernel Linux 5.16 through 6.x (Bluetooth ISO socket support introduced in a prior version, affecting all subsequent versions)
Timeline
- 2026-09-04: disclosed: CVE published on NVD
- 2026-08-27: patched: Fix merged upstream and in stable kernels